The issue was that the poisoning would posing the data *before* it gave
it to us as well, but I didn't clear out a pointer (qh->urbp) and later
dereferenced it.

Thanks for the report again and for the pci_pool patch so I could
troubleshoot it.

JE